Policy

kora checks every action against policy before it runs. policy-service compiles per-tenant OPA bundles from grants, roles, and a route-scope vocabulary. The edge OPA on the ingress gateway and the in-process middleware in each service both evaluate those bundles.

A denial returns before the handler executes. Nothing outside a principal's granted scope reaches the business logic.

For the components that author, compile, and distribute policy, see Policy plane.

ADRs: policy-gateway-and-authorisation-model, gateway-level-opa-enforcement-for-external-traffic, platform-scope-enforcement-middleware, dynamic-route-scope-registration.